OpenAI's AI pipeline found 948 Linux root exploits

What happened?

OpenAI on Wednesday unveiled an autonomous pipeline that finds, validates, exploits and patches vulnerabilities in the Linux kernel (OpenAI). In a mid-October run with an upcoming cyber model, it produced 948 working local privilege escalation (LPE) exploits that let an unprivileged user gain root on a commonly used desktop distribution. Each underlying bug also got a candidate patch.

How it works

Scout agents pick the security-relevant parts of the kernel: 5,034 audit targets, about 2.8 million lines or roughly 7% of the codebase. Analyst agents turned these into 2,308 candidate findings, and triage agents reproduced 1,724 of them in isolated virtual machines.

ExploitDev agents then tried to exploit the bugs with standard protections such as SMEP, SMAP and KASLR enabled. Human researchers reviewed each exploit, patch and severity rating before reporting. Only 3.1% of findings reflected incorrect analysis. OpenAI says the agents also used at least 10 novel kernel exploitation techniques, which it is not detailing for safety reasons.

What it cost

The full run cost $1,213,430 in API credits, about $1,279 per LPE exploit. Using historical Pwn2Own and TyphoonPWN payouts of $20,000 and $70,000, the 948 exploits would be worth $18.9M to $66.3M. On Google's hardened kernelCTF setup, a roughly $33K campaign yielded 21 LPE exploits.

Model progress shows clearly: in July, GPT-5.6 Sol found 166 unique LPEs with the same approach, while the newer cyber model found more than five times as many in October.

What happens to the bugs

OpenAI has already sent hundreds of reports and patches for critical bugs to kernel maintainers and is rolling out the rest with Patch the Planet partners. By the end of the 10-day scan, 61 LPEs were already fixed upstream, 43 had staging patches and 299 were being discussed publicly.

Why it matters

Vulnerability discovery is turning into an industrial process, with validation and patching as the bottleneck. OpenAI argues that on an unpatched system, a low-privileged account should now be treated as effectively equal to root for a well-resourced attacker. The practical takeaway: patch fast, isolate with sandboxes like Firecracker or gVisor, and rescan with every new model generation.